CRISC: Certified in Risk and Information Systems Control

Higher residual risks should be accepted only when they fall within the organization’s defined risk appetite—the amount and type of risk it is willing to retain in pursuing its objectives.